Splunk Search

How to split event data?

New Member

Hi! In the Event column, I get the following:

26/05/2020 11:24:51 > Invoice Val Increase on History Report process completed

I have tried multiple ways to get the "Report" name as, ie:

26/05/2020 11:24:51 > Invoice Val Increase on History Report process completed

How do I split that out?

0 Karma

Ultra Champion
...
| rex "\> (?<report>.*?Report)"

use rex

0 Karma

New Member

I have tried multiple ways to get the "Report" name only ie "Invoice Val Increase on History Report" quotes not required - how do I split that out please

0 Karma